@cosmicdrift/kumiko-framework 0.352.0 → 0.353.0

package/dist/api/pii-leak-guard.js

@@ -13,6 +13,9 @@ const CIPHERTEXT_REDACT_RE = new RegExp(CIPHERTEXT_RE.source, "g");
 // red; prod redacts + logs instead of shipping the blob. Scans unconditionally:
 // legacy ciphertext rows can outlive a subject KMS that later became
 // unconfigured, and the marker check itself needs no KMS access to run.
+// Buffers every JSON body (no streaming, roughly double peak memory for large
+// exports) on purpose: a size threshold or opt-out would be a leak bypass for
+// exactly the large responses most likely to carry raw rows.
 export function piiCiphertextResponseGuard() {
     return async (c, next) => {
         await next();

package/dist/api/route-registrars.d.ts

@@ -1,10 +1,11 @@
-import { Hono } from "hono";
+import { Hono, type MiddlewareHandler } from "hono";
 import type { DbConnection } from "../db/connection.js";
 import type { Lifecycle } from "../lifecycle/index.js";
 import type { Meter, PrometheusMeter } from "../observability/index.js";
 import type { EventConsumer } from "../pipeline/event-dispatcher.js";
 export declare const DEFAULT_MAX_REQUEST_BYTES = 1048576;
 export declare function registerBodyLimit(app: Hono, maxBytes: number): void;
+export declare function bodyLimitForRoutePath(path: string, maxBytes: number): readonly MiddlewareHandler[];
 export type MetricsRouteOptions = {
     readonly token?: string;
     readonly path?: string;

package/dist/api/route-registrars.js

@@ -31,6 +31,14 @@ export function registerBodyLimit(app, maxBytes) {
         return limit(c, next);
     });
 }
+// registerBodyLimit only covers /api/*; signature routes outside it (webhook
+// receivers, OAuth callbacks) read the raw body before verify() runs and so
+// need the same cap on their own handler chain.
+export function bodyLimitForRoutePath(path, maxBytes) {
+    if (maxBytes <= 0 || path === "/api" || path.startsWith("/api/"))
+        return [];
+    return [bodyLimit({ maxSize: maxBytes })];
+}
 // Timing-safe string compare — equal-length strings compare every byte
 // regardless of where they diverge; different lengths return false without
 // iterating. Prevents side-channel leaks on the Bearer-token check.

package/dist/api/server.js

@@ -40,7 +40,7 @@ import { piiCiphertextResponseGuard } from "./pii-leak-guard.js";
 import { createDefaultSseBroker } from "./redis-sse-broker.js";
 import { requestContext } from "./request-context.js";
 import { buildRequestContextData, requestIdMiddleware } from "./request-id-middleware.js";
-import { DEFAULT_MAX_REQUEST_BYTES, registerBodyLimit, registerHealthRoutes, registerMetricsRoute, registerVersionRoute, } from "./route-registrars.js";
+import { bodyLimitForRoutePath, DEFAULT_MAX_REQUEST_BYTES, registerBodyLimit, registerHealthRoutes, registerMetricsRoute, registerVersionRoute, } from "./route-registrars.js";
 import { createApiRoutes, handleUncaughtRouteError } from "./routes.js";
 import { createSseRoute } from "./sse-route.js";
 import { buildWebSocketSessionRevalidator, createWebSocketConnectionLimiter, hasWebSocketUpgradeServer, isWebSocketUpgradeRequest, WEBSOCKET_DEFAULT_MAX_CONNECTIONS_PER_USER, WEBSOCKET_DEFAULT_MAX_MESSAGE_BYTES, } from "./websocket-route.js";
@@ -782,7 +782,9 @@ export function buildServer(options) {
                 dispatchSystemQuery,
                 clientIpResolver,
             });
-            mountHonoRoute(app, route.method, route.path, honoHandler);
+            mountHonoRoute(app, route.method, route.path, honoHandler, route.entry === ExtraRouteEntries.signature
+                ? bodyLimitForRoutePath(route.path, options.maxRequestBytes ?? DEFAULT_MAX_REQUEST_BYTES)
+                : []);
         }
     }
     // /version-Default registriert NACH feature-routes — Hono "first match
@@ -927,6 +929,7 @@ function unauthenticatedResponse(c) {
     }, 401);
 }
 const webSocketLog = createFallbackLogger("websocket");
+const extraRouteLog = createFallbackLogger("extra-route");
 function webSocketErrorResponse(c, status, code, message) {
     return c.json({ error: { code, httpStatus: status, message } }, status);
 }
@@ -1069,10 +1072,15 @@ function buildExtraRouteHonoHandler(route, shared) {
                         }
                         return c.json(e.body, e.status);
                     }
+                    // The body goes to unauthenticated callers; infra errors thrown by
+                    // verify() (secrets, DB) must not leak, so the detail stays in the log.
+                    extraRouteLog.error(`signature verify() threw on ${c.req.path}`, {
+                        error: e instanceof Error ? e.message : String(e),
+                    });
                     return c.json({
                         error: {
                             code: "extra_route_signature_invalid",
-                            message: e instanceof Error ? e.message : String(e),
+                            message: "signature verification failed",
                         },
                     }, 401);
                 }

package/dist/api/sse-route.js

@@ -3,7 +3,7 @@ import { streamSSE } from "hono/streaming";
 import { tenantChannel } from "../engine/constants.js";
 import { isAnonymousSessionUser } from "../engine/system-user.js";
 import { Routes } from "./api-constants.js";
-import { getUser } from "./auth-middleware.js";
+import { getAuthTokenExpiry, getUser } from "./auth-middleware.js";
 import { accessInvalidationCredentialFor } from "./sse-broker.js";
 /**
  * Heartbeat-Cadence für SSE-Streams.
@@ -81,6 +81,9 @@ function decideWireFrame(event, user, options) {
         return undefined;
     return { name: event.type, data };
 }
+// setTimeout overflows (fires immediately) above 2^31-1 ms; a token that
+// outlives it just gets its stream recycled early, the client reconnects.
+const MAX_TIMER_DELAY_MS = 2 ** 31 - 1;
 export function createSseRoute(broker, options) {
     const route = new Hono();
     route.get(Routes.sse, async (c) => {
@@ -88,6 +91,9 @@ export function createSseRoute(broker, options) {
         // Channel is server-derived from authenticated user — never trust client input.
         // Allowing ?channel=... would let any authenticated user subscribe to other tenants' feeds.
         const channel = tenantChannel(user.tenantId);
+        // JWT expiry raises no access-invalidation event, so the stream must end
+        // itself when the token it was opened with expires.
+        const tokenExpiresAtSec = getAuthTokenExpiry(c);
         return streamSSE(c, async (stream) => {
             let resolveEnded;
             const ended = new Promise((resolve) => {
@@ -105,6 +111,9 @@ export function createSseRoute(broker, options) {
                 stream.writeSSE({ event: frame.name, data: JSON.stringify(frame.data) });
             }, closeStream);
             const unsubscribeAccessInvalidation = broker.subscribeAccessInvalidation(user.id, closeStream, accessInvalidationCredentialFor(user));
+            const expiryTimer = tokenExpiresAtSec === undefined
+                ? undefined
+                : setTimeout(closeStream, Math.min(MAX_TIMER_DELAY_MS, Math.max(0, tokenExpiresAtSec * 1000 - Date.now())));
             let released = false;
             const release = () => {
                 // skip: onAbort and the finally block both release, the second call is a no-op
@@ -113,6 +122,7 @@ export function createSseRoute(broker, options) {
                 released = true;
                 // A client disconnect must also wake the heartbeat sleep, not only a server close.
                 resolveEnded();
+                clearTimeout(expiryTimer);
                 broker.removeClient(channel, clientId);
                 unsubscribeAccessInvalidation();
             };

package/dist/bun-db/query.js

@@ -507,6 +507,11 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 parts.push(`${ref(col)} @> $${idx++}${p.sql}`);
                 values.push(p.bound);
             }
+            // A jsonb column holding the scalar itself is never `@>` an array of it.
+            if (isJsonbScalar(v)) {
+                parts.push(`${ref(col)} = $${idx++}::text::jsonb`);
+                values.push(JSON.stringify(v));
+            }
         }
         return parts.length > 0 ? `(${parts.join(" OR ")})` : "FALSE";
     }
@@ -592,8 +597,8 @@ function buildWhereClause(info, where, startIndex, qualifier) {
                 if (opKey === "ne" && pgType === "jsonb" && isJsonbScalar(opVal)) {
                     const p = prepareJsonbValue([opVal]);
                     if (p && p.kind === "param") {
-                        conditions.push(`(${ref(col)} IS NULL OR NOT (${ref(col)} @> $${idx++}${p.sql}))`);
-                        values.push(p.bound);
+                        conditions.push(`(${ref(col)} IS NULL OR NOT (${ref(col)} @> $${idx++}${p.sql} OR ${ref(col)} = $${idx++}::text::jsonb))`);
+                        values.push(p.bound, JSON.stringify(opVal));
                         continue;
                     }
                 }

package/dist/compliance/sub-processors.js

@@ -13,6 +13,11 @@
 // Lead-Time aus dem Compliance-Profile (typisch 30d). Cron-Job kommt
 // in Sprint 1 (compliance-profiles).
 //
+// SubProcessor has no "removed" state yet: a removed entry is deleted from
+// the array, so until the notification cron exists a removal is documented
+// only in the changelog. Removed so far: Mailbox.org (mailbox hosting),
+// replaced by ALL-INKL.COM on 2026-09-02.
+//
 // Quelle: docs/plans/datenschutz/compliance-profiles.md "Sub-Processor-
 // Management" + docs/plans/datenschutz/legal-artifacts.md.
 /**

package/dist/crypto/pii-field-encryption.d.ts

@@ -1,9 +1,8 @@
 import type { EntityDefinition } from "../engine/types/fields.js";
 import type { TenantId } from "../engine/types/identifiers.js";
-import { type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, type SubjectId } from "./kms-adapter.js";
+import { type KmsAdapter, type KmsContext, type LocalKeyKmsAdapter, PII_ERASED_SENTINEL, type SubjectId } from "./kms-adapter.js";
 import { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON } from "./pii-ciphertext-format.js";
-export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON };
-export declare const PII_ERASED_SENTINEL = "[[erased]]";
+export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL };
 export declare function encryptPiiValueForSubject(kms: LocalKeyKmsAdapter, subject: SubjectId, value: string, kmsCtx: KmsContext, field: string): Promise<string>;
 export declare function encryptPiiJsonValueForSubject(kms: LocalKeyKmsAdapter, subject: SubjectId, value: unknown, kmsCtx: KmsContext, field: string): Promise<string>;
 export declare function decryptPiiValueForSubject(kms: LocalKeyKmsAdapter, value: string, kmsCtx: KmsContext, field: string): Promise<string>;

package/dist/crypto/pii-field-encryption.js

@@ -16,12 +16,11 @@
 // a v2<->v3 prefix swap fails GCM instead of silently changing the type.
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { assertIrreversibleOperationAllowed } from "../pipeline/irreversible-operation-gate.js";
-import { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, subjectIdFromKey, subjectIdToKey, } from "./kms-adapter.js";
+import { isLocalKeyKmsAdapter, KeyAlreadyExistsError, KeyErasedError, KeyNotFoundError, PII_ERASED_SENTINEL, subjectIdFromKey, subjectIdToKey, } from "./kms-adapter.js";
 import { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_CIPHERTEXT_PREFIX_V1, } from "./pii-ciphertext-format.js";
 import { resolveSubjectForField } from "./subject-resolver.js";
 // Spec value (crypto-shredding.md) — renderers show it verbatim.
-export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON };
-export const PII_ERASED_SENTINEL = "[[erased]]";
+export { isPiiCiphertext, PII_CIPHERTEXT_PREFIX, PII_CIPHERTEXT_PREFIX_JSON, PII_ERASED_SENTINEL };
 const IV_LENGTH = 12;
 const AUTH_TAG_LENGTH = 16;
 function buildAad(subject, field, isJson) {

package/dist/db/entity-table-meta.js

@@ -222,6 +222,17 @@ export function deriveEntityTableMeta(entityName, entity, options) {
         assertUnmanagedTableName(tableName, "deriveEntityTableMeta/buildEntityTableMeta");
     }
     const idType = entity.idType ?? "uuid";
+    if (source === "unmanaged" && idType === "serial") {
+        // Unmanaged direct-write stores bypass validateRecordOwnedSubjects (it only walks
+        // feature.entities), yet encryptForDirectWrite still keys recordOwned fields as
+        // `record:<entity>:<id>`; forgetSubject requires a UUID, so the value could never be shredded.
+        const recordOwnedField = Object.entries(entity.fields).find(
+        // @cast-boundary schema-walk — PII flags live on the resolved field annotation
+        ([, field]) => field.recordOwned === true);
+        if (recordOwnedField) {
+            throw new Error(`deriveEntityTableMeta("${entityName}", { source: "unmanaged" }): field "${recordOwnedField[0]}" is recordOwned but the entity declares idType: "serial" — the record subject key is "record:${entityName}:<id>" and forgetSubject validates that id as a UUID, so this field could never be shredded. Use idType: "uuid", or give the field a different personal stance.`);
+        }
+    }
     // Base columns first, then user-fields. User-fields with the same
     // pg-name as a base-column OVERRIDE the base-column (last-wins, same
     // behavior as drizzle's `{ ...base, ...fields }` spread in the table

package/dist/db/event-store-executor-context.js

@@ -4,7 +4,7 @@ import { collectPiiSubjectFields, configuredPiiSubjectKms, decryptPiiFieldValues
 import { executeRawQueryRead } from "../db/queries/raw-sql.js";
 import { shiftParams } from "../engine/ownership.js";
 import { SYSTEM_TENANT_ID } from "../engine/types/identifiers.js";
-import { UniqueViolationError, writeFailure } from "../errors/index.js";
+import { InternalError, UniqueViolationError, writeFailure, } from "../errors/index.js";
 import { ArchivedStreamError, isStreamArchived } from "../event-store/index.js";
 import { assertUnreachable } from "../utils/index.js";
 import { rehydrateCompoundTypes } from "./compound-types.js";
@@ -289,31 +289,26 @@ export function buildExecutorContext(table, entity, options) {
             ...(await executeRawQueryRead(tenantDbRunner(db), sqlText, params)),
         ];
     }
-    // Combined, atomic read for the `expect:` precondition: the projection
-    // row's expect-checked fields AND the events table's current MAX(version)
-    // for this aggregate, in ONE SQL statement.
-    //
-    // Two separate reads leave a gap: applyEntityEvent writes the projection in
-    // a separate statement after its event commits, so a second reader can see
-    // a version that already reflects a concurrent writer's event while its read
-    // of the expect fields still shows the pre-write row. One query runs against
-    // a single consistent snapshot.
-    //
-    // The row's own `version` column can't be trusted instead: it is only in
-    // lock-step with the events for rows this executor wrote. A raw-seeded row
-    // (test fixtures, legacy data) can carry a default version with zero
-    // matching events, so deriving expectedVersion from it makes the append
-    // target a non-existent predecessor and fail.
-    // The events table's MAX(version) (0 for such a row) is the only value
-    // append() can safely use as expectedVersion — exactly what
-    // getStreamVersion() already returns for every other (non-`expect`)
-    // caller; this reads it in the same statement as the expect columns
-    // instead of a second round-trip.
-    //
-    // Reads raw column values — no decryptForRead pass — so `expect:` only
-    // supports plain (non-pii, non-encrypted) columns: business-state fields
-    // like status flags or foreign-key ids, not PII.
+    // Reads the `expect:` fields and the aggregate's MAX(version) in ONE statement:
+    // projection rows are written after their event commits, so two reads can
+    // pair a post-write version with a pre-write row.
+    // row.version can't stand in for MAX(version) — raw-seeded/legacy rows carry
+    // a default version with no matching events, so the append would target a
+    // non-existent predecessor.
+    // Raw column values, no decrypt pass: plain (non-pii, non-encrypted) columns only.
     async function loadExpectSnapshot(db, id, streamTenantId, expectKeys) {
+        for (const key of expectKeys) {
+            if (table[key] === undefined) {
+                throw new InternalError({
+                    message: `expect: "${key}" is not a column of entity "${entityName}"`,
+                });
+            }
+            if (encryptedFields.has(key) || piiSubjectFields.includes(key)) {
+                throw new InternalError({
+                    message: `expect: "${key}" on entity "${entityName}" is stored encrypted and cannot be compared as plaintext`,
+                });
+            }
+        }
         const quote = (name) => `"${name.replace(/"/g, '""')}"`;
         const columnOf = (field) => quote(table[field]?.name ?? toSnakeCase(field));
         const tableName = String(table[KUMIKO_NAME_SYMBOL]);

package/dist/db/migrate-generator.js

@@ -122,7 +122,10 @@ function diffOneTable(prev, next) {
         const uniqueChanged = (prevI.unique ?? false) === (idx.unique ?? false)
             ? undefined
             : { from: prevI.unique ?? false, to: idx.unique ?? false };
-        const whereSqlChanged = prevI.whereSql === idx.whereSql ? undefined : { from: prevI.whereSql, to: idx.whereSql };
+        // Whitespace-only re-rendering of the predicate must not drop and rebuild a large index.
+        const whereSqlChanged = whereSqlEqual(prevI.whereSql, idx.whereSql)
+            ? undefined
+            : { from: prevI.whereSql, to: idx.whereSql };
         const needsManualWhereChanged = (prevI.needsManualWhere ?? false) === (idx.needsManualWhere ?? false)
             ? undefined
             : { from: prevI.needsManualWhere ?? false, to: idx.needsManualWhere ?? false };
@@ -297,6 +300,11 @@ function renderColumnChange(tableName, change) {
 function toSingleLine(text) {
     return text.replace(/\s+/g, " ").trim();
 }
+function whereSqlEqual(a, b) {
+    if (a === undefined || b === undefined)
+        return a === b;
+    return toSingleLine(a) === toSingleLine(b);
+}
 function describeIndexChange(change) {
     const parts = [];
     if (change.columnsChanged) {

package/dist/db/queries/backfill-pii.d.ts

@@ -16,6 +16,7 @@ export type PiiBackfillResult = {
 };
 export type PiiBackfillScanCache = {
     forgottenAggregates?: ReadonlySet<string>;
+    destroyedTenants?: ReadonlySet<string>;
 };
 export type PiiBackfillBatchResult = PiiBackfillResult & {
     readonly lastEventId: string | null;

package/dist/db/queries/backfill-pii.js

@@ -380,8 +380,21 @@ export async function backfillEventPiiEncryptionBatch(db, registry, options = {}
         const forgottenAggregates = await loadForgottenAggregates();
         if (forgottenAggregates.has(aggregateId))
             return true;
+        if (subject.kind === "record" && subject.entity === "tenant") {
+            return (await loadDestroyedTenants()).has(subject.id);
+        }
         return subject.kind === "user" && forgottenAggregates.has(subject.userId);
     }
+    // A tenant destroyed before its name was record-owned never had a record key
+    // to erase, and destroy tombstones the row instead of emitting *.forgotten —
+    // read_tenants.destroyed_at is the only durable marker.
+    async function loadDestroyedTenants() {
+        if (scanCache.destroyedTenants)
+            return scanCache.destroyedTenants;
+        const rows = (await raw.unsafe(`SELECT id::text AS id FROM read_tenants WHERE destroyed_at IS NOT NULL`));
+        scanCache.destroyedTenants = new Set(rows.map((r) => r.id));
+        return scanCache.destroyedTenants;
+    }
 }
 // Stage 1 (payload) then stage 2 (projection row, when supplied) — stage 3
 // (erase) is the caller's call, made from the "unresolved" outcome.

package/dist/db/queries/shadow-swap.js

@@ -362,10 +362,13 @@ export async function countColumnDrift(tx, tableName, meta) {
 // object depends on the live table the swap fails loud and the whole rebuild
 // rolls back, leaving the old table untouched.
 export async function swapShadowIntoLive(tx, tableName) {
-    // Re-checked right before DROP: RLS could have been enabled after the early check.
-    await assertLiveTableHasNoRowLevelSecurity(tx, tableName);
     const raw = asRawClient(tx);
     const ident = quoteTableIdent(tableName);
+    // Held before the re-check so a concurrent ENABLE ROW LEVEL SECURITY either commits first
+    // (and is seen) or waits behind the DROP. Without it the catalog read takes no lock, and
+    // the unfenced paths (MSP rebuild, projection with no subscribed events) would drop RLS.
+    await raw.unsafe(`LOCK TABLE public.${ident} IN ACCESS EXCLUSIVE MODE`);
+    await assertLiveTableHasNoRowLevelSecurity(tx, tableName);
     await raw.unsafe(`DROP TABLE public.${ident}`);
     await raw.unsafe(`ALTER TABLE ${SCHEMA_IDENT}.${ident} SET SCHEMA public`);
 }

package/dist/engine/boot-validator/access-declarations.js

@@ -1,4 +1,4 @@
-import { escapeHatchGrantsProblem } from "@cosmicdrift/kumiko-types/handlers";
+import { escapeHatchGrantsProblem, isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
 import { accessAllowsAnonymous, declaredPersonalData, personalFieldNames, } from "../personal-data-fields.js";
 import { ANONYMOUS_ROLE } from "../system-user.js";
 import { collectZodObjectKeys } from "./zod-shape.js";
@@ -143,6 +143,20 @@ function validateAnonymousPersonalData(feature, handlerName, handler) {
         'request shares one caller identity, so owner-binding via from("user:id", ...) does not ' +
         "vouch for it; protection comes from the handler's required rateLimit (per ip).");
 }
+// The rateLimit is the only protection of a public-intake handler, so the
+// generic anonymous opt-out (rateLimit: { disabled: true }) must not apply.
+function validatePublicIntakeRateLimit(feature, handlerName, handler) {
+    // skip: not a public-intake handler, or its rateLimit is active
+    if (declaredPersonalData(handler.access) !== "public-intake")
+        return;
+    // skip: rateLimit is active
+    if (!isRateLimitDisabled(handler.rateLimit))
+        return;
+    throw new Error(`[Feature ${feature.name}] write handler "${handlerName}" declares ` +
+        'access.personalData: "public-intake" with rateLimit: { disabled: true } — the rateLimit ' +
+        'is the only protection for anonymous personal-data writes. Declare rateLimit: { per: "ip" ' +
+        'or "ip+handler", ... } instead.');
+}
 export function validateAccessDeclarations(feature) {
     for (const [handlerName, handler] of Object.entries(feature.writeHandlers)) {
         validateOpenToAllReason(feature, "write", handlerName, handler.access);
@@ -150,6 +164,7 @@ export function validateAccessDeclarations(feature) {
         validatePersonalDataValue(feature, handlerName, handler.access);
         validateOpenToAllPersonalData(feature, handlerName, handler);
         validateAnonymousPersonalData(feature, handlerName, handler);
+        validatePublicIntakeRateLimit(feature, handlerName, handler);
     }
     for (const [handlerName, handler] of Object.entries(feature.queryHandlers)) {
         validateOpenToAllReason(feature, "query", handlerName, handler.access);

package/dist/engine/boot-validator/entity-handler.js

@@ -1,8 +1,10 @@
+import { SELECT_OPTION_TONES } from "@cosmicdrift/kumiko-types/fields";
 import { isRateLimitDisabled } from "@cosmicdrift/kumiko-types/handlers";
 import { ZodObject } from "zod";
 import { VARIANT_NAME_PATTERN } from "../../derivatives/variant-key.js";
 import { access as accessPresets } from "../config-helpers.js";
 import { parseRefTarget } from "../parse-ref-target.js";
+import { isSelectOptionTone } from "./select-option-tone.js";
 export const FILE_FIELD_TYPES = new Set(["file", "image", "files", "images"]);
 // Field-Namen die typischerweise PII enthalten. Ohne `pii: true` /
 // `userOwned` / `tenantOwned` / `allowPlaintext`-Marker → Boot-Warning.
@@ -672,14 +674,25 @@ function validateCheckboxDisplayOptions(field, fieldName, entityName) {
         throw new Error(`MultiSelect field "${fieldName}" on entity "${entityName}" sets maxRows, which is only valid with display: "checkboxes".`);
     }
 }
+function assertSelectOptionTones(field, path, featureName) {
+    const tones = field.type === "select" ? Object.entries(field.optionTones ?? {}) : [];
+    for (const [optionValue, tone] of tones) {
+        if (!isSelectOptionTone(tone)) {
+            throw new Error(`[Feature ${featureName}] Entity select field "${path}" optionTones["${optionValue}"] is ` +
+                `"${String(tone)}" — expected one of ${SELECT_OPTION_TONES.join(", ")}.`);
+        }
+    }
+}
 export function validateEntitySelectOptionsQuery(feature) {
     for (const [entityName, entity] of Object.entries(feature.entities ?? {})) {
         for (const [fieldName, field] of Object.entries(entity.fields)) {
             assertNoSelectOptionsQuery(field, `${entityName}.${fieldName}`, feature.name);
+            assertSelectOptionTones(field, `${entityName}.${fieldName}`, feature.name);
             if (field.type !== "embedded")
                 continue;
             for (const [subName, subField] of Object.entries(field.schema ?? {})) {
                 assertNoSelectOptionsQuery(subField, `${entityName}.${fieldName}.${subName}`, feature.name);
+                assertSelectOptionTones(subField, `${entityName}.${fieldName}.${subName}`, feature.name);
             }
         }
     }

package/dist/engine/boot-validator/screens.js

@@ -4,7 +4,7 @@
 // into validateColumnRendererForm, splitting them would create a
 // same-folder require cycle.
 import { resolveActionIcon } from "@cosmicdrift/kumiko-types/action-icon";
-import { NO_WIDGET_FIELD_TYPES, optionsQueryFieldRefs } from "@cosmicdrift/kumiko-types/fields";
+import { NO_WIDGET_FIELD_TYPES, optionsQueryFieldRefs, SELECT_OPTION_TONES, } from "@cosmicdrift/kumiko-types/fields";
 import { NAV_ICON_KEYS } from "@cosmicdrift/kumiko-types/nav-icon";
 import { rowMetaFieldNames } from "../../db/table-builder.js";
 import { REFERENCE_LOOKUP_SOURCES } from "../../ui-types/list-row-meta.js";
@@ -12,9 +12,10 @@ import { isEncryptedAtRest } from "../config-helpers.js";
 import { parseRefTarget } from "../parse-ref-target.js";
 import { isKebabSegment, isValidQn, qualifyEntityName } from "../qualified-name.js";
 import { getAllowedFilterOps, isFieldFilterable } from "../screen-filter-ops.js";
-import { isExtensionEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../screen-helpers.js";
+import { isExtensionEditSection, isFieldsEditSection, isWriteFormEditSection, normalizeEditField, normalizeListColumn, resolveNavParentScreen, sectionFieldSpecs, } from "../screen-helpers.js";
 import { metricField } from "../types/index.js";
 import { LIST_ROW_META_COLUMN_NAMES } from "./entity-list-screens.js";
+import { isSelectOptionTone } from "./select-option-tone.js";
 // entityList and projectionList both allow a rowAction to double as the
 // row-body click target (rowClick: true, fw#1708/#2164) — at most one per
 // screen, or the renderer can't tell which one should fire.
@@ -345,19 +346,41 @@ function validateDrawerTargetAction(featureName, screenId, screenKind, actionLab
             `kind:"drawer" mounts an actionForm inside a Drawer widget — point "screen" at an ` +
             `actionForm screen, or use kind:"navigate" for a full-page target.`);
     }
-    // A prefill key the target form doesn't declare is dropped silently by the
-    // renderer (mergeSearchParamsIntoInitial iterates the target's fields), so
-    // the typo would only show up as an empty field at click time.
+    // The renderer (mergeSearchParamsIntoInitial) silently drops a prefill key
+    // when the target doesn't declare the field, marks it sensitive/password,
+    // or doesn't render it in its layout — each would only show up as an empty
+    // field at click time.
     // skip: no params extractor — nothing to check against the target's fields.
     if (action.params === undefined)
         return;
-    for (const fieldName of rowFieldExtractorKeys(action.params)) {
-        if (Object.hasOwn(target.fields, fieldName))
+    validateDrawerPrefillKeys(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}"`, action.screen, target, action.params);
+}
+function validateDrawerPrefillKeys(where, targetScreenId, target, params) {
+    const renderedFieldNames = new Set();
+    for (const section of target.layout.sections) {
+        if (!isFieldsEditSection(section))
             continue;
-        throw new Error(`[Feature ${featureName}] Screen "${screenId}" (${screenKind}) ${actionLabel} "${action.id}" ` +
-            `params prefills "${fieldName}", which drawer-target "${action.screen}" does not declare as a ` +
-            `field — the renderer would drop it and leave the form empty. Target fields: ` +
-            `${Object.keys(target.fields).sort().join(", ") || "(none)"}.`);
+        for (const spec of sectionFieldSpecs(section))
+            renderedFieldNames.add(normalizeEditField(spec).field);
+    }
+    for (const fieldName of rowFieldExtractorKeys(params)) {
+        if (!Object.hasOwn(target.fields, fieldName)) {
+            throw new Error(`${where} params prefills "${fieldName}", which drawer-target "${targetScreenId}" does not declare as a ` +
+                `field — the renderer would drop it and leave the form empty. Target fields: ` +
+                `${Object.keys(target.fields).sort().join(", ") || "(none)"}.`);
+        }
+        const targetField = target.fields[fieldName];
+        const isSensitiveOrPassword = targetField !== undefined &&
+            (("sensitive" in targetField && targetField.sensitive === true) ||
+                ("format" in targetField && targetField.format === "password"));
+        if (isSensitiveOrPassword) {
+            throw new Error(`${where} params prefills "${fieldName}", which drawer-target "${targetScreenId}" marks as ` +
+                `sensitive or password — the renderer never prefills those fields and would leave the form empty.`);
+        }
+        if (!renderedFieldNames.has(fieldName)) {
+            throw new Error(`${where} params prefills "${fieldName}", which drawer-target "${targetScreenId}" does not render in ` +
+                `its layout — the renderer only prefills fields the layout shows and would drop it.`);
+        }
     }
 }
 // The target can be any screen, so this checks the resolved target's
@@ -564,7 +587,7 @@ function validateFieldsXorGroups(errorPrefix, section) {
         throw new Error(`${errorPrefix} section "${section.title}" declares both fields and groups — pass fields: [] ` +
             `when using groups.`);
     }
-    if (section.fields.length === 0 && section.groups === undefined) {
+    if (section.fields.length === 0 && (section.groups?.length ?? 0) === 0) {
         throw new Error(`${errorPrefix} has a section "${section.title}" with zero fields — drop the section or add ` +
             `fields (or groups) to it.`);
     }
@@ -1048,6 +1071,12 @@ export function validateScreens(feature, featureMap, allWriteHandlerQns, allScre
                     }
                 }
             }
+            for (const [statusValue, tone] of Object.entries(screen.header?.statusTones ?? {})) {
+                if (!isSelectOptionTone(tone)) {
+                    throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) header.statusTones["${statusValue}"] ` +
+                        `is "${String(tone)}" — expected one of ${SELECT_OPTION_TONES.join(", ")}.`);
+                }
+            }
             if (Array.isArray(screen.header?.subtitle)) {
                 if (screen.header.subtitleHref !== undefined) {
                     throw new Error(`[Feature ${feature.name}] Screen "${screenId}" (projectionDetail) sets header.subtitleHref ` +
@@ -1782,8 +1811,9 @@ function validateDashboardChartDisplay(featureName, screenId, panel) {
         throw new Error(`${where} sets scrollable on chart "${panel.chart}" — only "stacked-area" supports it.`);
     }
     validateStackedAreaOnlyProps(where, panel);
-    if (panel.legendTotals !== undefined && typeof panel.legendTotals !== "boolean") {
-        throw new Error(`${where} has a non-boolean legendTotals.`);
+    const nonBooleanProp = ["brush", "legendTotals"].find((prop) => panel[prop] !== undefined && typeof panel[prop] !== "boolean");
+    if (nonBooleanProp !== undefined) {
+        throw new Error(`${where} has a non-boolean ${nonBooleanProp}.`);
     }
     for (const [key, color] of Object.entries(panel.seriesColors ?? {})) {
         if (typeof color !== "string" || color.trim() === "") {
@@ -1800,7 +1830,7 @@ function validateStackedAreaOnlyProps(where, panel) {
     // skip: stacked-area is the one chart kind that supports these props
     if (panel.chart === "stacked-area")
         return;
-    const stackedAreaOnly = ["markerKinds", "legendTotals", "ranges"].filter((prop) => panel[prop] !== undefined);
+    const stackedAreaOnly = ["markerKinds", "legendTotals", "ranges", "brush"].filter((prop) => panel[prop] !== undefined);
     if (stackedAreaOnly.length > 0) {
         throw new Error(`${where} sets ${stackedAreaOnly.join(", ")} on chart "${panel.chart}" — only "stacked-area" supports it.`);
     }

package/dist/engine/boot-validator/select-option-tone.d.ts

@@ -0,0 +1,2 @@
+import { type SelectOptionTone } from "@cosmicdrift/kumiko-types/fields";
+export declare function isSelectOptionTone(value: unknown): value is SelectOptionTone;

package/dist/engine/boot-validator/select-option-tone.js

@@ -0,0 +1,4 @@
+import { SELECT_OPTION_TONES } from "@cosmicdrift/kumiko-types/fields";
+export function isSelectOptionTone(value) {
+    return SELECT_OPTION_TONES.some((tone) => tone === value);
+}

package/dist/engine/build-app-schema.js

@@ -268,6 +268,7 @@ export function findNonJsonSafePath(value, path) {
 // one that contradicts the schema.
 function projectScreens(featureName, screens, registry, urlPrefillFieldsByScreenQn, encryptedConfigKeyQns) {
     return Object.entries(screens).map(([shortId, screen]) => {
+        assertValidScreenMultilineRows(featureName, shortId, screen);
         if (screen.type === "configEdit")
             return projectConfigEditScreen(screen, encryptedConfigKeyQns);
         if (screen.type === "projectionList")
@@ -330,7 +331,7 @@ function deriveProjectionListCapabilities(schema) {
 function projectEntities(entities) {
     const out = {};
     for (const [name, entity] of Object.entries(entities)) {
-        out[name] = projectEntity(entity);
+        out[name] = projectEntity(name, entity);
     }
     return out;
 }
@@ -339,9 +340,10 @@ function projectEntities(entities) {
 // einzeln auszuhandeln, walken wir die Field-Map und filtern auf die
 // Whitelist. Was nicht durchkommt: Server-only-runtime wie ZodValidate-
 // Functions, Computed-Functions, Default-Functions.
-function projectEntity(entity) {
+function projectEntity(entityName, entity) {
     const fieldsOut = {};
     for (const [fieldName, fieldDef] of Object.entries(entity.fields)) {
+        assertValidMultilineRows(`Entity "${entityName}"`, fieldName, fieldDef);
         fieldsOut[fieldName] = projectField(fieldDef);
     }
     // derivedFields MÜSSEN mit ins Client-Schema (nur die Metadaten, nicht die
@@ -380,6 +382,32 @@ function projectEntity(entity) {
 function projectDerivedField(derivedDef) {
     return { valueType: derivedDef.valueType };
 }
+// A textarea height that is not a positive integer cannot render anywhere; fail
+// at boot with the field name instead of letting each renderer guess a fallback.
+function assertValidMultilineRows(owner, fieldName, fieldDef) {
+    const multiline = fieldDef.type === "text" || fieldDef.type === "longText" ? fieldDef.multiline : undefined;
+    const rows = typeof multiline === "object" ? multiline.rows : undefined;
+    // Non-number values are not JSON-safe and get dropped by the projection below.
+    if (typeof rows === "number" && (!Number.isInteger(rows) || rows < 1)) {
+        throw new Error(`${owner} field "${fieldName}": multiline.rows must be a positive integer, got ${rows}`);
+    }
+}
+// Screen forms carry their own inline field maps into the client schema.
+function assertValidScreenMultilineRows(featureName, shortId, screen) {
+    const owner = `Screen "${featureName}:${shortId}"`;
+    const check = (fields) => {
+        for (const [fieldName, fieldDef] of Object.entries(fields)) {
+            assertValidMultilineRows(owner, fieldName, fieldDef);
+        }
+    };
+    if (screen.type === "configEdit" || screen.type === "actionForm")
+        check(screen.fields);
+    if (screen.type === "secretMint") {
+        check(screen.fields);
+        if (screen.confirm !== undefined)
+            check(screen.confirm.fields);
+    }
+}
 // Per-field whitelist. Every forwarded value must be JSON-safe (literal, or
 // an array/plain-object built only from JSON-safe values) — even though the
 // FieldDefinition types only type `default` as a literal, the sample-authoring